v0.0.12 — Security fixes

This patch fixes three issues found in a security audit:

• schain forget now reports cache deletion failures and exits nonzero when any selected vault cannot be cleared. Missing entries remain distinct from backend errors, and other selected vaults are still processed.
• Worktree discovery now reads .git, commondir, and gitdir through nonblocking, size-limited regular-file reads. FIFOs, devices, and oversized metadata cannot hang discovery or cause unbounded reads.
• Invalid schain set keys no longer echo the supplied secret value in error messages.

Regression tests cover partial and total cache deletion failures, backend error classification, unsafe metadata at all three lookup stages, and secret redaction. Local macOS tests and go vet passed; the release workflow also runs the full test suite on macOS and Linux.

Artifacts: macOS ARM64, Linux AMD64, Linux ARM64, and SHA-256 checksums.